Client Confidentiality

Investigations

CCC has been providing high-quality investigation services to clients since 1996. Where the experience of former members of new Scotland Yard’s Computer Crime Unit and Company Fraud Department come to bear. As detectives working at NSY, they were involved with some of the largest and most complex crimes of their times. Where circumstances have dictated, officers worked independently, while being part of a team. That experience remains with those at CCC equally at home, working either independently or as part of a team. The investigations we have undertaken are many and varied, and include the following areas:

  • Asset Tracing
  • Asset Stripping
  • Banking, On-shore & Off-shore
  • Blackmail
  • Company Fraud
  • Computer Forensics
  • Domestic Violence
  • Due Diligence
  • Hostile Takeover
  • Industrial Espionage
  • Intellectual Property (IP Theft)
  • Mergers & Acquisitions
  • Murder
  • Sexual Abuse
  • Share Ownership
  • Shipping Frauds
  • Unauthorised Access to computer networks

We understand how sensitive inquiries of any kind can be to all parties and that badly handled or insensitive investigations can cause more damage than the original incident. All our investigations are undertaken in a considered and controlled manner, where the potential risk to reputation is always at the forefront of our thoughts when making suggestions as to a particular course of action that may be required.

We also appreciate that in many, if not all cases where it may not be possible to conclusively prove that an individual was responsible for an incident. It is just as important to prove they were not responsible. Especially where there is an need for trust between the parties to remain.

Although many of our investigations start with the examination of digital devices. We can also undertake more traditional elements of investigations, such as due diligence or risk assessments. As well as having access to other investigative services that include bespoke qualitative due diligence services internationally, bug sweeps or TSCM (Technical Surveillance Counter-Measures), covert surveillance, vehicle tracking, through a long-standing trusted partner.

For more information on any of our capabilities, please email [email protected]

Computer Security Education & Awareness

Computer security education is an important element of providing a safe environment for digital assets.

CCC has provided a variety of education and awareness programs on differing aspects of computer security, these include:

  • advising on how to undertake internal investigations, the requirements for gathering evidence and the potential pitfalls that may be encountered.
  • educating employees on company policies and procedures.
  • ensuring employees understand the potential consequences of a breach, hence the reason for policies and procedures.

Get users to ‘buy into’ security…

I.T. Security Awareness

Talks and presentations should be aimed at raising staff and client awareness. We have found that a combination of question-and-answer sessions, combined with providing examples and giving demonstrations, has been the best approach.

Users with little or no technical abilities, who do not ‘buy into’ policies and procedures, looking to take shortcuts will increase the risk of compromise. Whereas those that understand the need to comply are likely to improve security. We have frequently found users circumventing or bypassing security measures simply because they were unaware of the implications or the measures were so restrictive that it prevented them from doing their work efficiently. Resulting in them looking for ways to get around those security measures.

We have also found it beneficial to break down the areas of education and awareness into the following groups.

  • Computer Security
  • Policies & Procedures
  • Malicious Programs
  • Wireless Exploitation
  • Password Security

One of the many gripes we have found employees to have are the password policies implemented by many companies, which are often poorly thought out. Resulting in users having difficulty remembering them because of their complexity or the frequency with which they are changed. It is quite possible that the reason for this is a lack of knowledge by the policymakers in relation to the real lifespan of a password, with decryption frequently cited as the main reason for policy.

Most policymakers have no experience of what is required to break a password. As a result, a ‘belt and braces’ approach is often taken, without fully understanding the impact on users or the increase in risk this may have. Forcing users to change their passwords every month can have a detrimental effect.

For example, a user may have a password that complies with policy, an example of which may be [email protected], with monthly changes resulting the password incrementally changing to [email protected], [email protected] etc.

Experience has shown that as time passes, users tend to forget the number they have reached, leading to frustration with passwords being written down. In reality,  good quality passwords can take years to decrypt even with the fastest and most sophisticated of attacks. Where, depending on circumstances, a more rational approach may be possible once company specific factors have been taken into consideration. Extending the life of a good quality password that meets company requirements has often been found to have a positive effect on users with no additional risk to the organisation.

Finally, senior management also needs to be seen to be complying with policy.

For more information email [email protected]

Open Source Intelligence OSINT - Computer Crime Consultants

Open Source Intelligence (OSINT)

Open Source Intelligence (OSINT) is the application of information gathering from public sources, which includes the collection, processing and analysis of data. With a view to utilising the results in the best possible way. At CCC, we understand the diversity of data sources and how to apply information identified.

Sources information include databases, published records, patent records and other data available to the public, effectively garnering such information, may require a variety of specialist techniques.

Where sources of information are likely to include social media and there is a possibility that the information could be used for litigation, there is a need to ensure that this information is from a legitimate source, accurate and has been obtained in an acceptable manner, with appropriate records being kept. Simply taking a series of screenshots while taking notes on a site may not be either sound or acceptable. Social media platforms are not designed to be ‘imaged or copied’ using conventional methods. Our tools and techniques meet those needs.

Most intelligence gathering exercises typically fall into the following areas:

  • Corporate
  • Criminal
  • Personal
  • Political

As such, these elements often form part of a case. Whether a fraud investigation, asset tracing enquiry or part of a larger and more comprehensive due diligence exercise. It is a discipline that we have become proficient at priding ourselves on being able to provide bespoke services that concentrate on a client’s specific needs within their specific arenas.

The aggregation of data from a variety of sources exponentially increases value

For more information regarding this service, please email [email protected]

Industrial Espionage – Consumer Sector - North America

Background

As part of a bi-annual internal security audit undertaken by our client. We were asked to confirm the findings of a report which stated that no abnormal activity had been identified during a review of firewall and router logs.

During our review, one anomaly we felt warranted further investigation was that for the preceding month, on the same three days of the week at 3am, the same workstation came to life. The initial review attributing the activity to a poorly configured ‘at’ command that did not warrant further investigation.

Investigation

It transpired that the workstation in question was in one of the few areas it was possible to get to, without passing CCTV cameras at the main entrances, or main walkways and thoroughfares within the facility.

CCC was asked to monitor activity emanating from the workstation, as well as reviewing historical data. From an examination of the historical data, it was possible to determine that the activity had not previously occurred, whilst electronic monitoring of the machine identified additional human activity.

Further monitoring showed that the user was targeting systems specifically used in relation to the research and development of new products. It was also possible to determine that an authorised user’s of those systems credentials was being used to gain access to the restricted part of the network.

Following a combination of electronic monitoring and traditional surveillance, the person identified as being responsible for accessing the computer was a cleaner employed by a contracted third party providing the services. It further transpired that ‘the cleaner’ was in fact an out of work research scientist, having been dismissed from his former employment for what was described as ‘inappropriate activity.’ Now looking for work, he thought it might be possible to either sell or use the information as a bargaining chip or tool with which to get a job with a competitor of the client’s. His knowledge of computer systems, and also allowed him to increase his user privileges to administrative levels by identifying and exploiting a vulnerability within the system. Giving him unrestricted access to the data found within research network.

Surveillance of the subject also found him visiting one of the client’s competitors. Before any harm could be done and agreement between the two companies was reached preventing litigation, whilst ensuring the client’s information would remain proprietary for a significant period.

Leaving the ‘cleaner’ looking for another job.

For more information regarding any of the services associated with this assignment, please email [email protected]

Intellectual Property Theft - Oil & Gas Sector

Background

A long-standing client working in the Oil and Gas industry had been at the forefront of developing innovative technologies in relation locating and identifying new sources of ocean borne energy had become concerned they were being targeted as a result of a break-in at an executive’s home where very little had been taken. Although there was evidence of documents being examined as well as items being moved in an area where the telephone lines entered the property and routers that provided both intra and internet services were accessible.

Investigation

Having been provided with rudimentary details of the client’s business and home networks, CCC deployed black boxes to monitor for unusual activity, which within days found that their mail server and back-up servers were being targeted and that the source of the attack emanated from a legitimate third-party connection.

Further investigation established that the specific email accounts being targeted belonged to members of staff, primarily engaged in the development as well as assisting with the provision of information in relation to patent applications.

As the client trusted the third-party, and with their co-operation, we were able to identify a wireless access point which had been compromised and despite our best efforts; it was not possible to specifically identify those responsible for the attack. Although the systems were secured together with additional protective measures were deployed.

For more information regarding any of the services associated with this assignment, please email [email protected]

Blackmail - Personal - Southern Europe

Background

We were contacted by our clients who received an SMS message from an unknown number demanding several million euros payment. Suggesting they could place compromising information into the public that that would cause even greater losses. The Client’s request was that those responsible for sending the message the identified and dealt with in such a way that they were no longer a threat and that the matter did not find its way into the public domain.

Investigation

Through a series of communications with the potential blackmailers, limited evidence was provided to suggest they could potentially damage both our client’s wealth and reputation.

Enquiries in relation to the phone number associated with the messages. Only identified, the likely service provider, country of origin and that the number was from a range associated with ‘pay as you go’ services.

The blackmailers were then informed that the client had appointed an agent to act on their behalf, with whom they would have to deal with in the future, which they agreed too.

As a result, an e-mail account with an appropriate domain name, together with mobile communications, was set up. That, if searched for, would appear to be in another country, but one which was well known to be associated with the client.

A series of further SMS communications between the parties that took place, implying that we wanted further proof of the evidence they had before any payments would be made. Because of the limitations of SMS messaging, the blackmailers agreed to communicate via anonymized e-mail, sending attachments they could not send via the phone. The information contained within the messages provided sufficient information to trace messages being sent to an internet café they were using in southern Europe.

Physical surveillance of the café was organised to coincide with an email response being sent and telephone call being made to the number provided, which led to identifying four individuals responsible for the attempted blackmail. One of whom was a former employee of the client.

Local legislation allowed for ex-parte orders to be obtained, allowing for all copies of potentially damaging material and electronic storage devices could be seized for destruction.

The blackmailers were also required to sign NDA’s or risk the prospect of a lengthy term of imprisonment.

Note:

When the damaging material was eventually identified and examined forensically, it was found to be composite pictures of the client together with other compromising material that had been morphed together using sophisticated techniques that were not apparent to the naked eye. With copies of the original images being found in an encrypted file on one of the blackmailer’s laptops.

For more information regarding any of the services associated with this assignment, please email [email protected]

Murder - Blackmail - Finance Sector

Background

The finance director of an East European branch of a UK company had been found dead locked in his car, in a forested area favoured by lovers, some distance from both his home and normal place of work. The cause of death a single shot to the head.

Having ‘investigated’ the matter, the local police had classified the case as suicide and the matter had been closed. Despite the car being locked and no firearm or suicide note being found either in or near the vehicle.

Having previously worked for the company on another matter, CCC was asked to assist with the investigation, both in relation to the interviewing of employees and the examination of computers used by the deceased. The purpose of which was to establish the real reason for the individual’s death and whether any work-related matters had a bearing.

Investigation

Once at the regional offices, it soon became clear that the local management appeared resentful and extremely economical with the truth. Preventing access to the victim’s office, stating that the victim’s workstation had been reallocated and that his laptop and mobile phone had gone missing.

It was decided that the only way of getting access to the workstation was to visit the premises when closed overnight and covertly get a forensic copy of the workstation’s hard disk drive for analysis. Having surreptitiously purloined a spare set of office keys and armed with the alarm codes provided by head office, we could get a copy of the hard disk drive with no one knowing.

Forensic Examination

An analysis of the contents identified:

  • Numerous files that had been deleted from the system on the day of our arrival.
  • Within the deleted files were several spreadsheets.
  • Also found in some file slack were partial elements of falsely created invoices.
  • Elements of communication between the victim and others, containing the location where the victim had been found.

Based on information found on the computer and several additional enquiries, it was possible to show that:

  • The victim was being blackmailed.
  • In order to service the extortion, he had been creating false records, including invoices, to cover the fact that he had been diverting company monies to make the pay-offs.
  • The location where the body was found appeared to be the regular meeting place for monies to change hands.

Further analysis of the false invoices identified a loss close to £1 million.

Further investigation into the background of the victim’s background and lifestyle strongly suggested that he had been involved with those ultimately responsible for blackmailing him for a number of years, and that they were closely associated with a local organised crime syndicate. And having reached a stage where he either refused or was unable to make any further payments, he was murdered to preserve the identity of those responsible. This it transpires was also the reason for the Police’s classification of suicide as opposed to murder.

Note:

Given the apparent collusion between local police and organised crime, together with other company specific risk factors. No further action has ever been taken.

For more information regarding any of the services associated with this assignment, please email [email protected].

Scroll to Top